文件列表:

Compiled (0, 2017-12-18)
Compiled\s32 (2048, 2017-12-18)
Compiled\s64 (2048, 2017-12-18)
Compiled\zacheck32.exe (11264, 2017-12-18)
Compiled\zacheck64.exe (14336, 2017-12-18)
Compiled\zadecode32.exe (10240, 2017-12-18)
Compiled\zadecode64.exe (12288, 2017-12-18)
Compiled\zadecrypt32.exe (14336, 2017-12-18)
Compiled\zadecrypt64.exe (15872, 2017-12-18)
Compiled\zaextract32.exe (12288, 2017-12-18)
Compiled\zaextract64.exe (13824, 2017-12-18)
Compiled\zamon32.exe (28672, 2017-12-18)
Compiled\zamon64.exe (33792, 2017-12-18)
LICENSE.md (1286, 2017-12-18)
Source (0, 2017-12-18)
Source\Harusame (0, 2017-12-18)
Source\Harusame\Harusame.vcxproj (11099, 2017-12-18)
Source\Harusame\Harusame.vcxproj.filters (5652, 2017-12-18)
Source\Harusame\Harusame.vcxproj.user (1046, 2017-12-18)
Source\Harusame\main.c (4744, 2017-12-18)
Source\Harusame\resource.h (388, 2017-12-18)
Source\Harusame\resource.rc (4602, 2017-12-18)
Source\Murasame (0, 2017-12-18)
Source\Murasame\Murasame.vcxproj (10731, 2017-12-18)
Source\Murasame\Murasame.vcxproj.filters (5373, 2017-12-18)
Source\Murasame\Murasame.vcxproj.user (680, 2017-12-18)
Source\Murasame\main.c (7452, 2017-12-18)
Source\Murasame\resource.h (388, 2017-12-18)
Source\Murasame\resource.rc (4616, 2017-12-18)
Source\Shigure (0, 2017-12-18)
Source\Shigure\Shigure.vcxproj (10984, 2017-12-18)
Source\Shigure\Shigure.vcxproj.filters (5371, 2017-12-18)
Source\Shigure\Shigure.vcxproj.user (1046, 2017-12-18)
Source\Shigure\main.c (7612, 2017-12-18)
Source\Shigure\resource.h (388, 2017-12-18)
Source\Shigure\resource.rc (4630, 2017-12-18)
Source\Umikaze (0, 2017-12-18)
Source\Umikaze\Umikaze.vcxproj (10595, 2017-12-18)
... ...

# ZeroAccess ## Toolkit for ZeroAccess/Sirefef v3 ZeroAccess is an advanced malware family (probably most advanced from all of available), whose first appearance was in the middle of 2009. Initially Win32 kernel mode rootkit, transformed then into user mode toolkit. Uses self made p2p engine for communication (main purpose - download files). Based on modular structure. Survived multiple takedown attempts (they were mostly serving marketing purposes of various so-called security companies/corporations). Has multiple generations of various toolkit modules. This project provide you insights into ZeroAccess v3 code and several instruments to work with ZeroAccess v3 files. Mostly for education purposes. # Project Contents **Umikaze - peer list (@ file) decoder** Processes input file as ZeroAccess peer file, type required for correct port assignation. Result is output file with Time and IP+Port pairs as text. > **Usage:** zadecode peerlist_filename [type 32 or ***, default 32], for example: zadecode s32 32 **Shigure - payload decryptor** Processes input as ZeroAccess payload container, attempting to decode it using RC4 and extract Microsoft Cabinet afterthat. > **Usage:** zadecrypt inputfile [outputfile], for example: zadecrypt 80000000.@ out.bin **Harusame - payload container verificator** Verifies if given file is valid container for ZeroAccess. Requires EA to be set at input file. More information about verification algorithm can be found in source. > **Usage:** zacheck inputfile [mode 32 or ***, default 32], for example: zacheck 80000000.@ 32 **Yuudachi - ZeroAccess p2p network crawler** GUI application that monitors given p2p botnet network and downloads payload from it. Downloaded files contain all required information for further verification by zacheck tool. Dumps collected peers in ZeroAccess format so they can be used as bootstrap next. Use x86-32 version for win32 botnet and x*** for win***. For work required proper bootstrap list and read/write access to current directory. **Murasame - dropper extractor** Extracts actual bot installation dropper from encrypted resource of high level dropper. > **Usage:** zaextract inputfile [outputfile] hexkey, for example: zaextract highlvlbot.bin lowlvlbot.bin 0x12345678 # System Requirements Does not require administrative privileges. Some tools may require read/write access for the their directories. Modern compatible NT version required, Windows XP not supported. For best appearance allow zamon32/zamon*** in firewall. # Build Project comes with full source code written in C. In order to build from source you need: Microsoft Visual Studio 2015 U1 and later versions. # Authors (c) 2016 ZeroAccess Project

近期下载者：

相关文件：

评论：[我要评论] [举报此文件]

收藏者：